Extracted

• • Target

    89961de645afe5c55dc9eeeb1394cc92d987a63b52820c05be9bd314f0e1aff0

  • Size

    1.5MB

  • MD5

    ca048aecf3863405e9cc73b663ea2c9c

  • SHA1

    4afbe34921aa6a088f12b9a82356def3b230168d

  • SHA256

    89961de645afe5c55dc9eeeb1394cc92d987a63b52820c05be9bd314f0e1aff0

  • SHA512

    7069400fdb2ba7b875407e0b8bcb5ceef974299147ca986a099a81fefccbb940534f17211ad4641b994abba3fb52816100b2b55591538b613b9f7662d2700df8

  • SSDEEP

    24576:r20h5REdBGY0vgBnT4WlBu/uUfCMgD8f/Heh4vOhwCbr:r2wWdQ9mnTHOuUUD83Heh4m6Cbr

  Score

  10^/10

  gcleanerdiscoveryloader

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2